We’re using Return to Service to wipe a group of iPads with the Return to Service option enabled under ‘PreStage enrollments’.  Now seeing iPads that have Software Update blocked with this message.   Unable to Check for Update   These settings are not available while this device is configured for Return to ServiceThis message shows on iPads even after an erase using Apple Configurator.Two questions. This now the default for all devices that support Return to Service even if not used on all iPads? How do we install any Software Updates if blocked? Jamf’s AI answers are telling me the fix is to unmanage these devices.

Does anyone know how to get rid of this option? I'm not very techy, but my daughter keeps bypassing onto bad websites by using this option. I'm using an image off the Internet as an example but this is exactly what it looks like. Thank you 😊  

Enrolling new laptops and Self Service+ is installing.  However at login we are seeing a pop up for intel based apps with the old Self Service logo stating this version of “Jamf” will not work with at future release of MacOS 

In Jamf Pro, We have policies to install the 2024 Microsoft Office suite LTSC during our Provision policy which is a script that calls each policy to install individual pieces of software we want to install on a Mac.Here is the order for the Microsoft install we have 2 policies:1. Install 2024 Microsoft Office 16.106.26020821.pkg(This is the older version from February. Testing. I tried the lastest version too)2. Install Microsoft_Office_LTSC_2024_VL_Serializer.pkg(I have also tried swapping the order)Ever since I can remember this has worked exactly as intended. The Office suite is installed then the volume serializer is installed to activate the license. At first launch it opens to the templates/recent documents page.However, over the last couple weeks of testing, the activation is no longer applying. I’ve tried everything I can to try and deactivate the license/reactivate it, but the only fix appears to be completely removing all office components, and reinstalling them - only then

Im testing Jamf/Entra Device Compliance. Everything is working as expected (Smart Groups, compliant/non-compliant criteria, Entra/Intune connector, etc). Now its time to focus on the actual registration workflow and policy logic to make it as painless as possible for my users.Does anyone have a customize workflow that improves the registration user experience? Popping up the Company Portal auth UI is not an elegant way to register our employees.🙏🏻

Hello,New to jamf school, I followed this page to install adobe with our shared device licence https://support.jamf.com/en/articles/12335537-deploying-adobe-applications-with-a-shared-device-license-with-jamf-schoolEverything runs perfectly but there is one major problem : The apps from the jamf “Apps installer” are only in english even if the creative cloud app from the package made with adobe console is in another language (as there is no link between them, except for licence I guess, cause Creative Cloud doesn’t detect the installations made from “Apps installer”) Is there any way to correct this ?

Hello, We are currently working on configuring Jamf Connect to get away from local AD binding. I have the initial login to macOS working (Google SSO Prompt and Duo MFA is working well.) After initial account creation when you’re prompted by Self Service + to sync your Google Account password to your local account, that is where it fails. The error is: “invalid password.”  In testing... any account outside or bypassed from Duo can query LDAP successfully. Accounts encompassed by Duo receive the same “invalid password” message via Self Service + or when running the LDAP query manually via terminal.  I’ve already spoken with Jamf support. They did some minor config changes, log searching, asked me to speak with Duo and then resolved the ticket. I have a support request into Duo at the moment but haven’t heard back. I’ve looked through both Duo’s policies and in Google Admin and haven’t come up with anything.  What am I missing? 

Hello everybody !I’ve been looking around, but without finding any real solution. Add to this changes from Apple / Jamf so what worked before may not work anymore, and of course what didn’t worked before may now be fine.I would like what’s the best practice to install minor or major updates of macOS on Apple silicon computers. Actually, I’m working on 2 scripts: one that will download the updates and another one that will install them later. The problem is: users have standard user account and of course, admin credentiales are needed.I’ve read that mdm commands aren’t very reliable, but as the posts are now from months ago, maybe that it’s working as expected now. And about those mdm commands, I don’t know if it downloads / installs only minor updates, or if it will install major ones if available.I was thinking of having the credentials as parameters for the scripts, but is is secure enough ?A last thing to ask: is there a way to install updates at the computer’s boot ? My main goal i

I have 2 questions with my Mac management with my on premise Jamf Pro instance.Before news MacOS is launch we would like to block the update while we made a couple of tests with our applications used in my university.What is the best way to block MacOS upgrade and for how long can we block the update? Second questions, After the pre stage enrollement i execute Jamf Setup Manager to install few applications and apply some configurations, i try to execute a script to reboot the computer but after reboot JSM runs again, how could i execute a reboot action after JSM properly?Thank you very much.

Hi,  we would like to add a watermark text in the background to all our prints. The solution should be distributable over Jamf Pro to our workers. Since now I tried to create this watermark with cupsfilter and ghostscript. Unfortanely both ways didn’t get the watermark in the backgrounds.  Have anyone another idea?  Best regards  Korbinian Eigner 

Cisco Secure Client (CSC): Version 5.1.12.146MacOS: Tahoe 26.5Current issue we are facing is that when enrolling new MacBooks into our environment we are seeing that Cisco Secure Client is no longer passing through deviceID to azure to pass through conditional access policies. Previously our environment was running JAMF conditional access, and our devices were enrolling without a problem. All applications were passing deviceID and going through conditional access policies (CAPs) without any blockers. Recently we have shifted over to platform SSO as per many people’s recommendation as the old method was being deprecated. Since then, we have noticed that most applications are still working without issues, but unfortunately Cisco Secure Client is failing to pass deviceID and is now being blocked by our Azure CAPs. The main difference that I'm seeing is that the previously enrolled devices also received a WJP certificate, while the new enrollment method no longer utilizes this check. We or

We’ll be teaming up with the recently launched Hi-Ed EDU Admins group on Thursday, July 2nd for an informative evening on the latest developments with macOS Security Compliance Project (mSCP).​•Expert Presentations​•Open discussion​•Networking with fellow Apple Admins​Date: Thursday, July 2nd​Time 6:00 to 8PM (PT)​Register at https://luma.com/s9o6hckt

Hello Jamf Nation!We’ve released Jamf Pro 11.30.0 beta. This release includes Inventory and API enhancements, logging improvements and more!  For full details, check out the release notes after enrollment.How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Click “Join Community” to join the beta forum once enrolled. If you encounter an error on Jamf Nation joining the beta forum, please log into Jamf Nation and then click “Join Community” again. Please also check out this recent blog on Configuring SSO in Jamf Account prior to testing Compliance Benchmarks, Blueprints, and App Switcher. Email beta@jamf.com with questions.The beta program is covered by the Jamf non-disclosure agreement; please do not share any information regarding your testing on any public forum, including the non-beta areas of Jamf Nation. Use the Jamf Nation Beta Forum or contact Jamf via beta@jamf.com with any questions. Thank you to all who participate in this program!

Happy Monday! So I just came across this issue.  When a user tries to change their password using Jamf Connect, they get this Kereberos error 4.So they go into Okta and change it there.  Later Jamf prompts them that the Local Password and Network password don’t match.  They are able to enter the old and new passwords and get the local mac password changed to match.  But Jamf still shows “password expires in 0 days”.I didn’t do the Jamf Connect setup, it was here when I joined the company, so I’m not sure exactly how to start fixing this.  I’m hoping you have some tips, maybe someone has seen this before, really anything.  I’ll keep doing my research, but It’s always nice to get some expert advice.-Pat

So It seems Apple has removed some MDM control of macOS updates in macOS 27 and they are only allowing using DDM commands to do this.Wanting to know if the Defer Major macOS updates MDM profile setting will work in macOS 27 or is this gone too? (I would assume that deferring upgrading to 27 will still work since older versions of the OS still support MDM update control. This is more about the future) I see with Jamf 11.29 that the download & schedule install is now DDM and works on prem but what we are really looking for is a way to continue Defer Major macOS updates for 90 days. We are not in Jamf cloud and not really looking to move.

I thought I had this right, but I’m not getting correct results…..Processor Type - Like - AppleandArchitecture Type - Is - amr64andOperating System - does not match regex - ^26(\..*)?$Still finding devices running 26. Someone have a better way to write this?Appreciate any nudges in the right direction! 

While rolling out Jamf safe internet we see this message in the dashboard for active devices.    

Hi everyone,I've been working through a deployment of Platform SSO Simplified Setup on macOS 26 using Microsoft Company Portal 5.2604.1 (5.2604.0 or newer is required per documentation), and I've hit a wall with username/account name mapping that I wanted to share in case others are running into the same thing and could potentially provide some alternative options.---Our Setup- Jamf Pro 11.28.1- macOS 26- Microsoft Company Portal 5.2604.1 (deployed as a PreStage package)- Microsoft Entra ID- PSSO profile with Simplified Setup enabled (EnableCreateFirstUserDuringSetup + EnableCreateNewUserAtLogin both true)- Authentication method: Password- Associated Domains payload included in the same profile---The ProblemEverything works end-to-end — Simplified Setup fires during the Setup Assistant, the user signs in with their Entra credentials, and a local account gets created. However, the local account short name is being set to the full preferred_username value (e.g. John.Smith@company.com), w

Hi all, I'm trying to upload a specific DMG file to cache to Waiting Room and run a simple script that just installs a PKG that has to be in the same folder as a JSON file. I believe the silent install script I have should work fine, it's just the actual uploading of the DMG file that has me puzzled. I've done this exact same thing with other DMG files that contained items inside (a .app file that I successfully moved to the Applications folder) but this is a PKG file alongside a JSON file which I assume has some kind of configuration it needs. When i upload the DMG in the Packages section, it looks like it uploads, I run the Cached command in the Policy, and I get a corrupted error:    [STEP 1 of 5] Executing Policy FireEye Agent [STEP 2 of 5] Caching package Fire Eye Agent 32 30 13... Downloading https://use1-jcds.services.jamfcloud.com//download/012345etc/IMAGEHXAGENTOSX323013.dmg?token=012345etc... Verifying DMG... Error: Could not verify the down

Hi all, I was wondering if I'm the only one no longer able to load the https://macadmins.software/ site that was previously hosted by Microsoft? When I go there now from any device I get a GoDaddy page, so it looks like they didn't renew the site hosting perhaps? I used this site all the time to get the most recent packages for Microsoft software. Is everyone else seeing the same thing as me? If so, has anyone heard anything about this, if this will be coming back or if that's it? I know for a while now while the links all pointed to the most recent versions of software, the version numbers listed on the site were stuck on some old version from many months back, but it was still working to download the most current releases as early as this month.

We're in the process of getting ready to implement JAMF Connect for syncing local accounts with Entra. Our current Wi-Fi is 802.1x PEAP where users sign in with their username and password, which we were told is not compatible. We're looking into certificate based auth using machine certs, but haven't found a clear answer on how to make this work. Our PKI is Microsoft ADCS, so we run up against the strong mapping requirements. We don't have SCEP right now and we are hoping to not open anything for inbound communication as we don't host anything on site anymore and have no real dmz for hosting things. We also don't want to bind to AD as that's pretty terrible. Has anyone gotten this set up in a similar environment? Thanks!

We are trying to push out a profile to have our Mac's (in a primarily Microsoft environment) to auto join our 802.1x network. I have setup the Jamf ADCS and am able to push a device cert to the Mac's that I would like to use. I created a policy in NPS to use that cert for authentication that I would like to use but am getting auth failures. Any guidance for how to remediate this? 

Hello everyoneMy context: wi-fi authentication based on 802.1x through a Windows Server (NPS). Computer certificates are deployed by Jamf (Configuraton Profile) and through the Jamf ADCS connector.Macs are not bound to the Windows domain but a computer object is created for every laptop (it's mandatory with a NPS server).Everything is working as intended. As you may know, in may 2022 Microsoft published an important security update that changes the way certificates are validated by domain controlers.https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16  A new extension identified by the OID "1.3.6.1.4.1.311.25.2" is now included in certificate templates, but only for the ones that build the subject information from Active Directory.Unfortunately, certificates issued through the Jamf connector are "offline", meaning that the subject information (CN, DNS name) are supp

Mac Apps, App Installers, Jamf Apps, Jamf App Catalog… whatever name you know it by, the feature found in your Jamf Pro server at Computers – Mac apps – Jamf App Catalog is a great tool for deploying and patching many commonly used Apps which aren’t available through Apple’s App Store. For the sake of clarity, I will refer to them as App Installers for the remainder of this post. App Installers do have some caveats which are documented here. Being aware of those is well and good, but even the most experienced admins can make mistakes. Jamf Pro will not alert you if you have done something like overlapped scopes for different deployments of the same App Installer title.If this occurs, that App Installer will likely cease to recalculate its deployment as more Macs are added to the Computer Group it is scoped to. If you toggle the “stuck” app’s deployment off and back on again, it’ll force it to recalculate and the Macs it was missing will begin to receive it.This overlapping scope behavi

We use jamf school to reset laptops in classrooms, everything is installed in nl_NL but all Adobe apps stay in english. If we create a dutch package in Adobe admin console and try to upload it in jamf we get a parse xml error.  Tried all suggestions from AI but no succes..